// SafePass is a zero-knowledge password manager.
// Your master PIN never leaves this device.
// Even our servers can't read your secrets.
// SafePass Terminal v1.0.0
// Type 'help' for available commands
_
/* TRUSTED BY ENGINEERING TEAMS AT */
// HOW IT WORKS
Your secrets never touch our servers unencrypted. The math guarantees your privacy.
Set a master password and a unique PIN. Your PIN is never stored — it exists only in your memory.
vault --init --pin ****** --algo PBKDF2-SHA256Site passwords are encrypted client-side with AES-256-GCM. The ciphertext is stored, the key is yours alone.
encrypt --input password123 --cipher AES-256-GCMEnter your PIN to unlock the vault. Decryption happens in your browser. Zero secrets reach our servers.
decrypt --vault-id ****** --pin ****** --output stdout// FEATURES
Built on modern cryptography. Designed for privacy.
AES-256-GCM with client-side key derivation. Your PIN is never transmitted or stored. Even we cannot access your vault.
Your 4-8 character PIN combines with PBKDF2 to wrap the Vault Encryption Key. Wrong PIN = garbage output.
10 one-time backup codes securely wrap the same VEK. Each code self-destructs after use.
All encryption and decryption happens in your browser or extension. The API stores only encrypted blobs.
Auto-fill credentials across the web. Service worker handles crypto with 12-hour auto-lock timer.
Web Crypto API with PBKDF2 at 600,000 iterations. Brute-forcing the PIN is computationally infeasible.
Encrypted vault syncs across devices. Your PIN is the universal key — nothing else is needed to decrypt.
Every vault access is logged. You can review exactly which credentials were viewed and when.
// TESTIMONIALS
The people who care most about security choose SafePass.
“We migrated 2,000+ employee credentials to SafePass in one week. The PIN-based encryption gives our security team confidence that even a server breach won't leak passwords.”
“The zero-knowledge architecture is exactly what we needed for SOC 2 compliance. No other password manager offered true client-side encryption with PIN protection.”
“I've tried every password manager. SafePass is the only one where I truly believe the provider can't access my data. The math checks out.”
One endpoint. Any language. Get results in milliseconds.
curl -X POST https://api.emailvalidator.dev/validate \
-H "Content-Type: application/json" \
-H "X-Api-Key: YOUR_API_KEY" \
-d '{"email": "user@example.com"}'// GET STARTED
$ encrypt --all --algorithm zero-knowledge
// Your secrets, your keys, your control.
// FAQ
Everything you need to know about SafePass.
Your PIN is combined with a salt to derive a wrapping key using PBKDF2-SHA256 (600,000 iterations). This key wraps the Vault Encryption Key (VEK) — a random 32-byte value that encrypts each credential. Without your PIN, the VEK cannot be recovered, and without the VEK, your credentials cannot be decrypted. The PIN never leaves your device.
During initialization, you receive 10 one-time backup codes. Each backup code also wraps the same VEK. You can use any unused backup code to unlock your vault and set a new PIN. Store these codes offline — we cannot recover them.
No. The encryption key is derived from your PIN in your browser. Our servers only store encrypted ciphertext and the wrapped VEK. This is a zero-knowledge architecture — mathematically impossible for us to decrypt your data.
We use AES-256-GCM for credential encryption. Each credential gets a unique salt, and the encryption key is derived via HKDF-SHA256(VEK, salt). The VEK itself is wrapped using AES-KW with a key derived from your PIN via PBKDF2-SHA256 at 600,000 iterations.
Yes. The SafePass extension auto-fills credentials on any website. The extension uses its own crypto service worker with a 12-hour auto-lock timer. If the timer expires, you must re-enter your PIN to unlock.
Yes. The vault automatically locks 12 hours after your last PIN entry. When locked, the PIN-derived key and the VEK are purged from memory. You must re-enter your PIN to resume access.
The PIN is never sent to our API. The wrapping and unwrapping of the VEK is handled entirely client-side in our crypto library. You can inspect the source code — all crypto operations are open for audit.
Your account password is used for authentication (signing in). Your PIN is used exclusively for encryption — it derives the key that protects your vault. They serve different purposes and we recommend using different values.